---
id: 5037
title: "Cookie Chaos: How to bypass __Host and __Secure cookie prefixes"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/cookie-chaos-how-to-bypass-host-and-secure-cookie-prefixes"
published_at: "2025-09-03 14:46"
tags: ["cookies", "asp-net", "unicode", "django", "cookie-tossing", "session-security"]
phying_url: "https://phying.com/item/5037"
lang: en
---

# Cookie Chaos: How to bypass __Host and __Secure cookie prefixes

## Summary

Unicode whitespace bypasses __Host- and __Secure- cookie prefixes: browsers treat the cookie as unrestricted, but servers such as Django and ASP.NET trim the character and honour the protected name.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2025-09-03 14:46
- **Original:** https://portswigger.net/research/cookie-chaos-how-to-bypass-host-and-secure-cookie-prefixes
- **Phying News:** https://phying.com/item/5037